UlisesGascon

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

@fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key

@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit

@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload

@fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

@fastify/static vulnerable to route guard bypass via non-canonical path segments